Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Test that a diff's path and content are sanitized before they render

Open Beginner friendly
  • Is something wrong?
#38 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
82/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
typescript
Domain
cli, testing

Research direction

Read the diff rendering paths in src/render.ts and the existing runner cases in test/render.test.ts; trace how the diff and note views draw edit paths and file content. Add cases for escape sequences and carriage returns in both inputs, then assert rendered lines contain no control characters and carriage returns become newlines. Confirm each case fails when its corresponding sanitize call is removed.

Written by the indexing model from the issue text.

Description

enhancement good first issue

Problem

src/render.ts passes each edit diff's path and diff through sanitize before drawing them, so a string from a file or the daemon cannot drive the terminal. test/render.test.ts covers sanitizing the tool's text result, but no test covers the diff fields. If the sanitize calls in the diff preview were dropped, every suite would still pass.

path comes from the tool call's arguments and diff is built from file contents, so both can carry control sequences (for example a file name or file content holding \x1b] or \r). The one-line note is fixed text built in src/diff.ts, so it needs no sanitizing, but the path drawn beside it does.

Proposal

Add render suite cases, driven through Pi's runner as the existing render cases are, where:

  • an edit's path holds an escape sequence and a carriage return, for both the diff view and the note view
  • the file content behind the diff holds the same

Assert that the drawn lines hold no control characters and that a carriage return became a newline. Check that each case fails when its sanitize call is removed.

Dominant language
TypeScript
Stars
2
Forks
1
Avg merge
10h 45m
Merged PRs (30d)
20

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from gortexhq/pi

All issues in gortexhq/pi

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.